git.iko.soy/typeable/oauth2-proxy
on master help sign in
Update Keycloak documentation
f07a563Nick Meves
CHANGELOG.md+5
compare with master
unifiedsplit
@@ -4,6 +4,8 @@
4
4
5## Important Notes
5## Important Notes
6
6
7+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Keycloak will now use `--profile-url` if set for the userinfo endpoint
8+ instead of `--validate-url`. `--validate-url` will still work for backwards compatibility.
7- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
9- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
8- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
10- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
9- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
11- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
@@ -33,6 +35,8 @@
33
35
34## Breaking Changes
36## Breaking Changes
35
37
38+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) In config files & envvar configs, `keycloak_group` is now the plural `keycloak_groups`.
39+ Flag configs are still `--keycloak-group` but it can be passed multiple times.
36- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
40- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
37- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow
41- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow
38 - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
42 - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
@@ -54,6 +58,7 @@
54
58
55## Changes since v6.1.1
59## Changes since v6.1.1
56
60
61+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves)
57- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
62- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
58- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
63- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
59- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
64- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
docs/docs/configuration/auth.md+19−9
@@ -135,15 +135,25 @@ If you are using GitHub enterprise, make sure you set the following to the appro
135
135
136Make sure you set the following to the appropriate url:
136Make sure you set the following to the appropriate url:
137
137
138− -provider=keycloak
138+ --provider=keycloak
139− -client-id=<client you have created>
139+ --client-id=<client you have created>
140− -client-secret=<your client's secret>
140+ --client-secret=<your client's secret>
141− -login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
141+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
142− -redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
142+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
143+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
143− -validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
144+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
145+ --keycloak-group=<first_allowed_user_group>
144− -keycloak-group=<user_group>
146+ --keycloak-group=<second_allowed_user_group>
145−
147+
148+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
149+flags can be used to specify which groups to limit access to.
150+
151+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
152+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
153+Keycloak userinfo endpoint response.
154+
146−The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.
155+The group management in keycloak is using a tree. If you create a group named admin in keycloak
156+you should define the 'keycloak-group' value to /admin.
147
157
148### GitLab Auth Provider
158### GitLab Auth Provider
149
159
providers/keycloak.go+1−3
@@ -80,9 +80,7 @@ func (p *KeycloakProvider) EnrichSession(ctx context.Context, s *sessions.Sessio
80 }
80 }
81
81
82 groups, err := json.Get("groups").StringArray()
82 groups, err := json.Get("groups").StringArray()
83− if err != nil {
83+ if err == nil {
84− logger.Errorf("Warning: unable to extract groups from userinfo endpoint: %v", err)
85− } else {
86 for _, group := range groups {
84 for _, group := range groups {
87 if group != "" {
85 if group != "" {
88 s.Groups = append(s.Groups, group)
86 s.Groups = append(s.Groups, group)